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In all papers on the BB84 protocol, the transmission probability of each bit value is usually set to be equal. In 
this paper, we show that by assigning different transmission probability to each transmitted qubit within a single 
polarization basis, we can generally improve the key generation rate of the BB84 protocol and achieve a higher 
key rate. 
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I. INTRODUCTION 
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Quantum Key Distribution (QKD) has attracted great atten- 
tion as an unconditionally secure key distribution scheme. The 
basic idea of QKD protocol is to exploit the quantum mechan- 
ical principle that observation in general disturbs the system 
being observed. Thus, if there is an eavesdropper (Eve) lis- 
tening while the two legitimate communicating users, namely 
Alice and Bob, attempt to transmit their key, the presence of 
the eavesdropper will be visible as a disturbance of the com- 
munication channel that Alice and Bob are using to generate 
the secret key. Alice and Bob can then throw out the key bits 
established while Eve was listening in, and start over. The key 
generation rate, which is the length of the securely sharable 
key per channel use, is one of the most important criteria for 
the efficiency of the QKD protocol. The first QKD protocol, 
which was proposed in 1984 [1], is called BB84 after its in- 
ventors (Bennet and Brassard). 

QKD protocol usually consists of two parts: a quantum and 
a classical part. In the quantum part, Alice sends qubits pre- 
pared in certain states to Bob. The states of these qubits are 
encodings of bit values randomly chosen by Alice. Bob per- 
forms a measurement on the qubits to decode the bit values. 
For each of the bits, both the encoding and decoding are cho- 
sen from a certain set of operators. After the transmission 
steps, Alice and Bob apply sifting where they publicly com- 
pare the encoding and decoding operator they have used and 
keep only the bit pairs for which these operators match. 

Once Alice and Bob have correlated bit strings, they pro- 
ceed with the classical part of the protocol. In a first step, 
called parameter estimation, they compare the bit values for 
randomly chosen samples from their strings to estimate the 
quantum channel. After the parameter estimation, Alice and 
Bob proceed with a classical processing, where Alice and Bob 
share a secret key based on their bit sequences obtained in the 
quantum part. 

Mathematically, quantum channels are described by trace 
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preserving completely positive (TPCP) maps [2]. Convention- 
ally, in the BB84 protocol, we only used the statistics of the 
matched measurement outcomes, which are transmitted and 
received in the same basis, to estimate the TPCP map that 
describes the quantum channel, while the mismatched mea- 
surement outcomes, which are transmitted and received in dif- 
ferent bases, were discarded. However, Watanabe et al. [3] 
showed that by using the statistics of both matched and mis- 
matched measurement outcomes, the TPCP maps describing 
the quantum channel can be estimated more accurately. They 
implemented a practical classical processing for the six-state 
and BB84 protocols that utilizes their accurate channel esti- 
mation method and showed that the key rates obtained with 
their method were at least as high as the key rates obtained 
with the standard processing by Shor and Preskill 01 . 



In the BB84 protocol [1], Alice creates random bits of and 
1 with equal probability. Then, Alice and Bob each chooses 
between the two bases, i.e. the rectilinear basis (or z basis) of 
vertical (0°) and horizontal (90°) polarizations, and the diago- 
nal basis (or x basis) of 45° and 135° polarizations, with equal 
probability. Lo et al. JH proposed a simple modification of 
the standard BB84 protocol [1] by assigning significantly dif- 
ferent probabilities to the different polarization bases during 
both transmission and reception. They showed that the modi- 
fication could reduce the fraction of mismatched measurement 
outcomes, thus nearly doubles the efficiency of the BB84 pro- 
tocol. 



In this paper, we propose a modification of the BB84 pro- 
tocol by assigning a different transmission probability to each 
transmitted qubit within a single polarization basis. While in 
classical information, assignment of different probability to 
each input bit can increase the mutual information of asym- 
metric channels [6, Problem 7.8], in quantum key distribution 
the benefit of assigning a different transmission probability to 
each transmitted qubit was unknown. We show that by setting 
a different transmission probability to each transmitted qubit, 
we can improve the key rate and achieve a higher key rate. 
We demonstrate this fact by using the accurate channel esti- 
mation over the amplitude damping channel. We determine 
the optimum bit transmission probability that maximizes the 
key rate. 



2 



II. MODIFICATION OF BB84 PROTOCOL 

In this section, we describe a modification of the BB84 pro- 
tocol where the transmission probability of each qubit within 
a single polarization basis is not necessarily equal. The pro- 
tocol consists of a quantum and a classical part. The quantum 
part includes the distribution and measurement of quantum in- 
formation, and is determined by the operators that Alice and 
Bob use for their encoding and decoding. 

For simplicity, we assume that Eve's attack is the collective 
attack 1 , i.e. the channel connecting Alice and Bob is given by 
tensor products of a channel from a qubit density matrix 
to itself. As is usual in a lot of QKD literature, we assume 
that Eve can access all the environment of channel The 
channel to the environment is denoted by S E . 



A. Quantum part: Distribution of Quantum Information and 
Measurement 

In the modified BB84 protocol, Alice chooses random bits 
of and 1 according to the probability distribution 

Px(0):= q) Px(l):=l-q. (1) 

Alice modulates each bit into a transmission basis that is ran- 
domly chosen from the z basis {|0 Z ),|1 Z )} and the x basis 
{|Q*)>|1*)}> where |0 fl ) and |1„) are the eigenstates of the 
Pauli matrix <7 a for a g {*,z}. We occasionaly omit the sub- 
scripts of the basis, and the basis {|0),|1)} is re- 
garded as z basis unless otherwise stated. Then Bob randomly 
chooses one of the measurement observables a a for a E {x,z}, 
and converts a measurement result +1 or — 1 into a bit or 
1, respectively. Note that Alice and Bob keep the the mis- 
matched measurement outcomes to estimate the channel more 
accurately. 



B. Classical part: Parameter Estimation and Classical 
Processing 

The classical part of the protocol that we consider is essen- 
tially the same as the classical part of the protocol proposed 
by Watanabe et al. JH. However, since we assign a different 
transmission probability to each transmitted qubit with a sin- 
gle polarization basis (see Eq. (Q}), some adjustments need to 
be made accordingly. 

The classical part of our protocol consists of two sub- 
protocols, called parameter estimation and classical post- 
processing. The main purpose of the parameter estimation 
subprotocol is to estimate the amount of information gained 
by the eavesdropper Eve during the distribution of the quan- 
tum information. 



By using the de Finetti representation arguments Q,@], the result can be 
extended to the coherent attack. 



After the parameter estimation, Alice and Bob proceed with 
a classical subprotocol. Hereafter, we treat only Alice's bit se- 
quence x £ that is transmitted in z basis and the correspond- 
ing Bob's bit sequence y £ F^ that is received in av measure- 
ment, where F2 is the finite field of order 2. Our goal is to 
generate a secure key pair (Sa , Sb), using x and y. Here Alice 
and Bob want to generate a key pair (Sa,S,s) which is statis- 
tically independent of Eve's information by cloning the quan- 
tum objects and looking at the conversation over the public 
authenticated channel. The protocol we consider is one-way, 
i.e. only communication from Alice to Bob or from Bob to 
Alice, is needed. It consists of the following steps: 

1. Information Reconciliation: Alice sends error correc- 
tion information to Bob. Using the correction informa- 
tion, Bob decode the bit string y into an estimate of x. 

2. Privacy Amplification: Alice randomly chooses a hash 
function from a set of universal hash functions and 
sends the choice to Bob over the public channel. Then, 
Alice and Bob compute Sa and S#, respectively. 

The above procedure is usually called the direct reconcili- 
ation. The procedure in which the roles of Alice and Bob are 
switched is called the reverse reconciliation 12]. 

Since the pair of the sequences (x,y) is transmitted and re- 
ceived in z basis, they are independently identically distributed 
according to 

Pxr(x,y) :=P x (x)(y z \g B (\x 7 )(x z \)\y z ). (2) 

Note that the distribution Pxy can be estimated from the statis- 
tics of the sample bits that are transmitted in z basis and mea- 
sured by the observable av. 

The secure key rate is determined according to the result of 
the privacy amplification [7]. For the direct reconciliation, let 

H p {X\E):=H{p XE )-H{p E ) (3) 

be the conditional von Neumann entropy with respect to den- 
sity matrix 

Pxe := E Px(x)\x)(x\®M\*)(x\), (4) 
xe¥ 2 

where H(p) is the von Neumann entropy for a density matrix 
p and Px{x) is the probability distribution shown in Eq. (Q]). 
The secure key rate 10] is 

H p {X\E)-H(X\Y). (5) 

While for the reverse reconciliation, we can calculate the 
conditional von Neumann entropy H p {Y\E) := H(pye) — 
H(Pe) from the channel $<& as follows. We define 

p AB :=(I^£ B )(W)(¥\), (6) 
for the entangled state 

|V/>:=V?|00) + V ^^|11). (7) 
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Let ^abe be a purification of Pab, and let Pbe '■= \^abe\- 
Then the density matrix Qye is derived by measurement on 
Bob's system, i.e. 

Pye := L (\y)(y\®i)pBE(\y)b\®i). (8) 

For the reverse reconciliation, the secure key rate |7|] is 

H p (Y\E)-H(Y\X). (9) 

III. EVALUATION OF KEY RATE 

A. Estimation of Eve's Ambiguity 

In the Stokes parametrization, the qubit channel Sb can be 
described by the affine map parametrized by 12 real parame- 
ters Old as follows: 
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(10) 



where (0,, X , y ) describes a vector in the Bloch sphere Q|. 
When Alice and Bob use only z basis and x basis, the statis- 
tics of the input and output are irrelevant to the parameters 
(R zy ,R xy ,Ry Z ,Ry X ,Ryy,ty) in Eq. ( fTOt . Thus we can only esti- 
mate the parameters CO — (R zz ,R zx ,R xz ,R xx ,t z ,t x ) by the accu- 
rate channel estimation y|] and we have to consider the worst 
case |H] for the parameters co, i.e. 



F(co):= min H Pt (X\E), 



(11) 



where ^'(co) is the set of all parameters T = 
(R Z y,R xy ,Ry Z ,Ry X ,Ryy,t y ) such that the parameters CO and 
T constitute a qubit channel, and p T is the density matrix 
which corresponds to the parameter T. 

We can simplify the form of the desired function F(co) 
when Eve's ambiguity is convex JH. We can prove the con- 
vexity of Eve's ambiguity with respect to Sb in our protocol by 
using the same technique used by Watanabe et al. [3, Lemma 
2]. By the convexity of Eve's ambiguity, the minimization in 
Eq. ( fTTT i is achieved when the parameters R zy , R^, R yz , R yx , 
and fy, are all [3, Proposition 1]. Hence, the number of free 
parameters can be reduced to 1 and the remaining free param- 
eter is Ryy. Thus the the problem is rewritten as looking for an 
estimator of 



F(co)= min H p (X\E), 



(12) 



where &(co) is the set of parameters Ryy such that the param- 
eters CO and Ryy consitute a qubit channel when other parame- 
ters are all 0, and p# vv is the density matrix corresponding to 
the parameter Ryy, 



B. Key Rates of Amplitude Damping Channel 

In this section, we calculate the key rates of the BB84 proto- 
col with our proposed procedure over the amplitude damping 
channel, and determine the optimum bit transmission prob- 
ability that maximizes the key generation rate. We clarify 
the fact that the key rates using the optimum bit transmission 
probability of the proposed BB84 protocol is higher than those 
of the conventional protocol J^]. 

In the Stokes parametrization, the amplitude damping chan- 
nel S p is given by the affine map 
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(13) 



where < p < 1. 

In the BB84 protocol, we can estimate the parameters R zy = 
1 - P, R zx = 0, R xz = 0, R xx = VI ~ P, h = p, and t x = 0. 
As explained in the previous section, we can set R zy = Rxy = 
R yz = R zy = R yx = ty = 0. Furthermore, by the condition on 



the TPCP map |11] 



(R xx -R yy ) 2 <(l-R Z z) 2 -tl 



(14) 



we can decide the remaining parameter as Ryy — VI — P- 

By straightforward calculation, the asymptotic key genera- 
tion rates for the direct and reverse reconciliations are 



and 



h(q+p(l-q))-h(p(l-q) 
%) - h[p{\ - q) 



(15) 



(16) 



respectively, where /;(•) is the binary entropy function. 

From Eqs. ( fT5b and ( fT6b . we can easily see for p = 0, the 
asymptotic key generation rates for both direct and reverse 
reconciliations reach the maximum value when q=\- Please 
recall that q is the bit transmission probability of bit (see Eq. 
©)• 

We can derive the optimum bit transmission probability by 
the extreme value theorem. Let q be the optimum bit transmis- 
sion probability, i.e. the bit transmission probability (of bit 0) 
that maximizes the key generation rate such that the key gen- 
eration rate is positive. Then the channel parameter p and the 
optimum bit transmission probability q satisfy the following 
condition: 



• For direct reconciliation 

l-q ( p(l-q) ^ 



q \i -/?(!-<?) 

where < p < 1 and < q < I. 
• For reverse reconciliation 



(17) 



l-p(l-g) 
P(l-q) 



q + p(l-q) 

(1-/0(1-3) 



(18) 



where < p < j and < q < 1 . 
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FIG. 1: (Color online) Comparison of the asymptotic key genera- 
tion rates against the channel parameter p of the amplitude damping 
channel S p . "Proposed Reverse" and "Proposed Direct" are the max- 
imum asymptotic key generation rates for the reverse and direct rec- 
onciliations with the optimum bit transmission probability q, respec- 
tively. While "Conventional Reverse" and "Conventional Direct" are 
the asymptotic key generation rates for the reverse and direct recon- 
ciliations when q = j, respectively given in jj. 

The key rates for the direct and reverse reconciliations using 
the optimum bit transmission probability are plotted in Fig. Q] 
We find that the proposed key rates, i.e. the key rates when 
q = q, are higher than the conventional ones [3], i.e. the key 
rates when q = A, in both the direct and reverse reconcilia- 



tions. In the direct reconciliation, the proposed key rate is 
slightly higher than that of the conventional one so that the 
lines of the two key rates seem to overlap one another. While 
in contrast, in the reverse reconciliation, the proposed key rate 
grows much higher than the conventional one as the parameter 
p increases. And especially when the parameter p > 0.7, we 
can see that the proposed key rate is more than twice as high 
as the conventional one. 



IV. CONCLUSION 

In this paper, we proposed a simple modification of the 
BB84 protocol where the transmission probability of each 
qubit within a single polarization basis is not necessarily 
equal. We showed that by assigning a different transmis- 
sion probability to each transmitted qubit, we can generally 
increase the key generation rate of the BB84 protocol. We 
demonstrated this by using the accurate channel estimation 
over the amplitude damping channel. We determined the opti- 
mum bit transmission probability that maximizes the key gen- 
eration rate. We showed that in general, assignment of an 
equal probability to each qubit within a single polarization ba- 
sis is not necessarily optimal in QKD protocol. 

Acknowlegdment 

We would like to thank Dr. Shun Watanabe for valuable 
discussions. 



[1] C. H. Bennett and G. Brassard, in Proc. IEEE Int. Conf. Com- 
puters Systems and Signal Processing (Bangalore, India, 1984), 
pp. 175-179. 

[2] M. A. Nielsen and I. L. Chuang, Quantum Computation and 
Quantum Information (Cambridge University Press, 2000). 

[3] S. Watanabe, R. Matsumoto and T. Uyematsu, Phys. Rev. A 78, 
042316 (2008). 

[4] P. W. Shor and J. Presk ill, Phys. Rev. Lett. 85, 441 (2000), 

|arXiv:quant-ph/00030"04"1 
[5] H. K. Lo, H. F. Chau and M. Ardehali, J. Cryptol. 18, 133-165 

(2005). 



[6] T. M. Cover and J. A. Thomas, Elements of Information Theory 

(John Wiley & Sons, 2006), 2nd ed. 
[7] R. Renn er, N. Gisin and B. Kra us, Phys. Rev. A 72, 012332 

(2005), [^fiv:quant-ph/0502064l 
[8] R. Renner, Nature Physics 3, 645 (2007), 

|arXiv:quant-ph/0703069| 
[9] U. Maurer, IEEE Trans. Inform. Theory 39, 733 (1993). 
[10] A. Fujiwara and H. Nagaoka, IEEE Trans. Inf. Theory 44, 1071 

(1998). 

[11] A. Fujiwara and P. Algoet, Phys. Rev. A 59, 3290 (1999). 



